🔥 40% Off Crucial Exams Memberships — This Week Only

2 days, 12 hours remaining!
Crucial Exams

ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

A security analyst must be alerted whenever more than 20 failed SSH login attempts are recorded against any Amazon Linux EC2 instance within a five-minute window. The instances already stream their /var/log/secure files to a central CloudWatch Logs group. Which action will generate the metric that can be used to trigger a CloudWatch alarm while keeping costs minimal?

  • Define a CloudWatch Logs metric filter for the pattern "Failed password" in the log group and publish it as a custom metric.

  • Turn on an AWS Config rule that evaluates security group ingress for port 22 and configure SNS notifications for non-compliant findings.

  • Create VPC Flow Logs for each subnet and query them with Amazon Athena every five minutes using a scheduled query.

  • Enable detailed monitoring on the EC2 instances and configure a CloudWatch alarm on the EC2 StatusCheckFailed metric.

ISC2 Systems Security Certified Practitioner (SSCP)
Risk Identification, Monitoring and Analysis
Your Score:
Settings & Objectives
Random Mixed
Questions are selected randomly from all chosen topics, with a preference for those you haven’t seen before. You may see several questions from the same objective or domain in a row.
Rotate by Objective
Questions cycle through each objective or domain in turn, helping you avoid long streaks of questions from the same area. You may see some repeat questions, but the distribution will be more balanced across topics.

Check or uncheck an objective to set which questions you will receive.

Wipe Score
Bash, the Crucial Exams Chat Bot
AI Bot